Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2023 01:00
Static task
static1
Behavioral task
behavioral1
Sample
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe
Resource
win10v2004-20230220-en
General
-
Target
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe
-
Size
62KB
-
MD5
09a29f3b529c5e9ab25a47973bb0900a
-
SHA1
b8dce851d01dbe0335f11fa8449b52a2270776e6
-
SHA256
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a
-
SHA512
35e92a26fc392b15eb7fd78ca1f6a6c08afe42ed535fd020237215d7f4db0f66fa0676eb70d646f8790c9724c30c605a99b33cf6a6c84c3de78f6061f1a48efb
-
SSDEEP
1536:s2JbaiIZApuLzOgkx9MbEze4g3ViceSITKdU:dbahZApuL1kx9MbEze4g3ViceYO
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
Processes:
resource yara_rule C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
dllhost.exewinlogson.exepid process 3488 dllhost.exe 4704 winlogson.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2144 schtasks.exe 2960 schtasks.exe 3472 schtasks.exe 4956 schtasks.exe 5036 schtasks.exe 32 schtasks.exe 4524 schtasks.exe 3108 schtasks.exe 2152 schtasks.exe 1596 schtasks.exe 3364 schtasks.exe 228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exepowershell.exepowershell.exepowershell.exedllhost.exepid process 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe 4052 powershell.exe 4052 powershell.exe 1436 powershell.exe 1436 powershell.exe 3892 powershell.exe 3892 powershell.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe 3488 dllhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exepowershell.exepowershell.exepowershell.exedllhost.exewinlogson.exedescription pid process Token: SeDebugPrivilege 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe Token: SeDebugPrivilege 4052 powershell.exe Token: SeDebugPrivilege 1436 powershell.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeDebugPrivilege 3488 dllhost.exe Token: SeLockMemoryPrivilege 4704 winlogson.exe Token: SeLockMemoryPrivilege 4704 winlogson.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winlogson.exepid process 4704 winlogson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.execmd.exedllhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2912 wrote to memory of 1332 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe cmd.exe PID 2912 wrote to memory of 1332 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe cmd.exe PID 2912 wrote to memory of 1332 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe cmd.exe PID 1332 wrote to memory of 3844 1332 cmd.exe chcp.com PID 1332 wrote to memory of 3844 1332 cmd.exe chcp.com PID 1332 wrote to memory of 3844 1332 cmd.exe chcp.com PID 1332 wrote to memory of 4052 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 4052 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 4052 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 1436 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 1436 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 1436 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 3892 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 3892 1332 cmd.exe powershell.exe PID 1332 wrote to memory of 3892 1332 cmd.exe powershell.exe PID 2912 wrote to memory of 3488 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe dllhost.exe PID 2912 wrote to memory of 3488 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe dllhost.exe PID 2912 wrote to memory of 3488 2912 33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe dllhost.exe PID 3488 wrote to memory of 3448 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 3448 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 3448 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1540 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1540 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1540 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1980 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1980 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1980 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2256 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2256 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2256 3488 dllhost.exe cmd.exe PID 3448 wrote to memory of 3364 3448 cmd.exe schtasks.exe PID 3448 wrote to memory of 3364 3448 cmd.exe schtasks.exe PID 3448 wrote to memory of 3364 3448 cmd.exe schtasks.exe PID 3488 wrote to memory of 4100 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4100 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4100 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2280 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2280 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2280 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2596 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2596 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2596 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4488 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4488 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4488 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2920 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2920 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2920 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1508 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1508 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 1508 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4424 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4424 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 4424 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2116 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2116 3488 dllhost.exe cmd.exe PID 3488 wrote to memory of 2116 3488 dllhost.exe cmd.exe PID 2256 wrote to memory of 4956 2256 cmd.exe schtasks.exe PID 2256 wrote to memory of 4956 2256 cmd.exe schtasks.exe PID 2256 wrote to memory of 4956 2256 cmd.exe schtasks.exe PID 4100 wrote to memory of 32 4100 cmd.exe schtasks.exe PID 4100 wrote to memory of 32 4100 cmd.exe schtasks.exe PID 4100 wrote to memory of 32 4100 cmd.exe schtasks.exe PID 2596 wrote to memory of 228 2596 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe"C:\Users\Admin\AppData\Local\Temp\33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6656" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6656" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1689" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1689" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2545" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2545" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8812" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8812" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\SystemFiles\config.jsonFilesize
310B
MD5ed14dd820f7a202af04496de4b86cedd
SHA10b9440d08060f4d45fbb6f35c8dbdc60f135fd7f
SHA2560d09f312bb2722572c6efe16c989a9cd52fb54d2f5faf04a05ddb88e64e0f4ef
SHA512002749f33f789aed6a27594fef7259bfe9dcd36b84433e7f1be9e173217dfa3adf2180b7d0623fc10a1e1466c7002532884f45784c4c6652d504eefadc6d8482
-
C:\ProgramData\SystemFiles\sys_rh.binFilesize
1KB
MD59bc83276af97842def832a8e4a57ff89
SHA1f9412e836938d2e67b1681ef562955218568bd74
SHA25633f0be926c68f749a4fbede88a55ee546e00dd9041ec762a6d491d30b2286492
SHA512161c14dcc27cd66ee2c77dc959308a7c5aa1d94da356cd663cf93e4aa47b3eb54e1f799f9e4f202bc9fea2af84043899ce829954e85f50deb320a7ce9ec3d9ac
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5cc1dae9249e235591533731019c6cca2
SHA137f23cb131763dc54f2ddd416ac2ccf58c355da6
SHA2560781b41898284e1b7bb468660178d4e98bd14c9015498b6a53afd270c7a2f0d7
SHA512a7969558dddafe928d7dc5c1066da945669683abef7e495a68b924eaece7ede1a173215047b3d2a62e9c70296450d703ef48fce3a62b5e4ce393e9fe8c1ec347
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD518ebb6cf86d3e22b4cb8b624d9b4ee72
SHA119fb0d05c2560d822c0f5145a337dffb9f555136
SHA2569c1dc2a55494627805138300e214519de579992024a16e7b77090c7d48876058
SHA512dc19f3040a9b330780d051df858dddb056b2c0f77ea98ec392c1c4687e80fafe13b8c01a99e75f38b37d41b400e5a4f9fb0004f1ed4dc676330191d060f39de1
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mfcn1ezm.bpc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1436-208-0x000000007F5E0000-0x000000007F5F0000-memory.dmpFilesize
64KB
-
memory/1436-196-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/1436-197-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/1436-195-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/1436-198-0x00000000705E0000-0x000000007062C000-memory.dmpFilesize
304KB
-
memory/2912-133-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/2912-136-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/2912-137-0x000000000AD40000-0x000000000AD4A000-memory.dmpFilesize
40KB
-
memory/2912-138-0x000000000C1C0000-0x000000000C226000-memory.dmpFilesize
408KB
-
memory/2912-183-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/2912-135-0x000000000ABB0000-0x000000000AC42000-memory.dmpFilesize
584KB
-
memory/2912-134-0x000000000AF20000-0x000000000B4C4000-memory.dmpFilesize
5.6MB
-
memory/3488-243-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3488-238-0x0000000000560000-0x000000000056C000-memory.dmpFilesize
48KB
-
memory/3488-239-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3892-232-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/3892-215-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/3892-233-0x000000007F2B0000-0x000000007F2C0000-memory.dmpFilesize
64KB
-
memory/3892-222-0x00000000705E0000-0x000000007062C000-memory.dmpFilesize
304KB
-
memory/3892-220-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/4052-157-0x00000000705E0000-0x000000007062C000-memory.dmpFilesize
304KB
-
memory/4052-155-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/4052-169-0x0000000007940000-0x000000000795A000-memory.dmpFilesize
104KB
-
memory/4052-168-0x0000000007FA0000-0x000000000861A000-memory.dmpFilesize
6.5MB
-
memory/4052-171-0x0000000007990000-0x000000000799A000-memory.dmpFilesize
40KB
-
memory/4052-172-0x0000000007BC0000-0x0000000007C56000-memory.dmpFilesize
600KB
-
memory/4052-167-0x0000000006BB0000-0x0000000006BCE000-memory.dmpFilesize
120KB
-
memory/4052-177-0x0000000007B60000-0x0000000007B6E000-memory.dmpFilesize
56KB
-
memory/4052-179-0x0000000007BA0000-0x0000000007BA8000-memory.dmpFilesize
32KB
-
memory/4052-178-0x0000000007C60000-0x0000000007C7A000-memory.dmpFilesize
104KB
-
memory/4052-156-0x0000000006BD0000-0x0000000006C02000-memory.dmpFilesize
200KB
-
memory/4052-170-0x000000007F750000-0x000000007F760000-memory.dmpFilesize
64KB
-
memory/4052-154-0x0000000006610000-0x000000000662E000-memory.dmpFilesize
120KB
-
memory/4052-144-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/4052-143-0x0000000005740000-0x0000000005762000-memory.dmpFilesize
136KB
-
memory/4052-142-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/4052-141-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/4052-140-0x0000000005840000-0x0000000005E68000-memory.dmpFilesize
6.2MB
-
memory/4052-139-0x0000000005040000-0x0000000005076000-memory.dmpFilesize
216KB
-
memory/4704-250-0x0000018DAE770000-0x0000018DAE790000-memory.dmpFilesize
128KB
-
memory/4704-252-0x0000018DAE7C0000-0x0000018DAE800000-memory.dmpFilesize
256KB
-
memory/4704-253-0x0000018DB00A0000-0x0000018DB00C0000-memory.dmpFilesize
128KB
-
memory/4704-254-0x0000018DB00A0000-0x0000018DB00C0000-memory.dmpFilesize
128KB